CVE-2026-11351

ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Shinystat Analytics

CVE-2026-11974

Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Media Folder Addon

CVE-2026-14333

Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Demi

CVE-2026-14830

FlxWoo < 3.1.1 - Unauthenticated Payment Bypass

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Flxwoo

CVE-2026-14833

Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above (who lack the unfiltered_html capability) to store JavaScript that runs when a visitor or administrator opens the lightbox.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Lightbox With Photoswipe

CVE-2026-14834

Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX

The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Mailgun For Wordpress

CVE-2026-14849

Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Paid Member Subscriptions

CVE-2026-14922

WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()` (`wppa-functions.php:2623-2624`). Because `wp_strip_all_tags()` only removes *real* tags, an attacker who submits a **double HTML-entity-encoded** payload (e.g. `&amp;lt;img src=... onload=...&amp;gt;`) passes the write filters as harmless entity text and is stored one decode-level down (`&lt;img ... onload=...&gt;`).

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Photo Album Plus

CVE-2026-14927

FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data (names, email addresses, billing and shipping postal addresses, and order details) across the store.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Fluentcart

CVE-2026-14928

JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Js Help Desk

CVE-2026-14929

JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Js Help Desk

CVE-2026-14930

JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Js Help Desk

CVE-2026-14931

JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Js Help Desk

CVE-2026-15048

GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Geekybot

CVE-2026-15258

Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Product Feed Manager For Woocommerce

CVE-2026-12720

Kirki < 6.0.13 - Unauthenticated PHP Object Injection

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress version), this could be leveraged to perform a variety of attacks, such as remote code execution.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Kirki

CVE-2026-12721

Kirki < 6.0.13 - Unauthenticated SQL Injection

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Kirki

CVE-2026-13392

ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-super subsite Administrator, who is otherwise denied code/file editing, reach host-level code execution beyond the privileges the network grants them.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Elementskit Lite

CVE-2026-13393

ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript; on a multisite network this lets a non-super subsite Administrator, who is denied unfiltered_html, plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Elementskit Lite

CVE-2026-12695

miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Miniorange 2fa